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ELECTRONIC CONTROL SYSTEM AND METHOD HAVING 
MONITOR PROGRAM MONITORING FUNCTION 

CROSS REFERENCE TO RELATED APPLICATION 
5 This application is based upon and claims the benefit of 

Japanese Patent Application No. 2001-28459 filed on February 5, 
2 001, the contents of which are incorporated herein by reference, 

BACKGROUND OF THE INVENTION 
Ittf 1 - Field of the Invention 

The present invention relates to an electronic control 
fT system and method that are capable of detecting microcomputer 
rj malfunction by monitoring operations of one microcomputer by 
another one. Especially, the present invention relates to a 
ilk throttle control microcomputer and method that conduct 
O electronic throttle control of an engine of a vehicle. 
2 . Related art 

^] nnt r n n in nnntmi gyR t 0m s have the moja jJbQr^ft€y-~ Tunc Liup ^ 
to detect a microcomputer malfunction by monitoring ope^tftions 

20 of a plurality of microcomputers one another. Fcfr example, an 
electronic control system of a vehicle^hcis an engine control 
microcomputer for executing engijxe^control (spark ignition, fuel 
injection or the like) and^a throttle control microcomputer for 
executing electronic! throttle control. A monitoring program is 

25 provided in the engine control microcomputer, thereby to monitor 
the th^dttle control microcomputer in the engine control 
mi^ir ocorfiputer . For — rrrs^ani ce , — in — trrS^ patent NoZ GrSrSrO-r-QSA, 




- 1 - 



/^J^-A-^r3r^2^t252 ) , arr-eng±rre— coTrtnrcnl— 1^ a 
throttle control microcomputer. When tjxe- — ghqine control 
microcomputer detects malf un^t-iofr of the throttle control 
microcomputer , thg^erfgine microcomputer resets the throttle 
control_iftit5rocomputer and executes the throttle control in place 
k§— the— t hr^rrei e contTtrt-mie^ oeempu-te^. 



yL^dln-Q^d ejL Lu incied s- o reliability and s a-fcty of th e thro t fc^ 
control microcomputer, it is desired to monitor op^&arCions of 
x the monitoring program itself. Theref^eT^in JP-A-1 1-294252 , 
lC3g watch-dog pulse is outputte^p^riodically , and the watch-dog 
m pulse is inputted^.a^atch-dog timer. Thus, monitoring program 
^ is watph^cfT It is, however, required to provide a hardware IC 
re- watch — Lhe monitoring progiram? 



1§3 SUMMARY OF THE INVENTION 

lI it is therefore an object of the present invention to 

provide an electronic control system, which is capable of 
obviating the above problem. 

It is another object of the present invention to provide 
20 an electronic control system, which is capable of attaining a 
monitoring function of a microcomputer. 

is programmed to control a first object such as a fuel-injection 
or ignition timing of an engine. The^irsfmicrocomputer has a 
25 monitor program f or^j&h^cking malfunction of a second 
microcomputgr-^periodically . The second microcomputer is 



HRRt ed Lu con trol a second object s uch as a LhrotLle 
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marc orT The tirst micro computrer—eompxi h^r a timp n_and_ a timei^ 

setting unit. The timer increases or decre^^stime count in 
proportion to time, and switches^j-trs output logic level of its 
port when the time coun£^?^aches a predetermined time. The timer 
5 setting unit^a^s new time count in place of the time counted 
bvj>hr6rimer when an operation of the second microcomputer is 
no^ ma-Jr— and— th e— mo^iter—pro gram— i norma-Jr. 

BRIEF DESCRIPTION OF THE DRAWINGS 
l|f Other objects, features and advantages of the present 

jfl invention will be understood more fully from the following 
Jjjf detailed description made with reference to the accompanying 

drawings. In the drawings: 
j\ FIG. 1 is a block diagram showing an electronic control 

ifu system for engines according to a first embodiment of the present 
S invention; 

FIG. 2 is a flow diagram showing a base routine executed 
by an engine control microcomputer in the first embodiment; 

FIG. 3 is a flow diagram showing an interrupt routine 
20 executed by the engine control microcomputer in the first 
embodiment; 

FIG. 4 is a timing diagram showing a check processing of 
the monitor program in the first embodiment; 

FIG. 5 is a block diagram showing an electronic control 
25 system for engines according to a second embodiment of the present 
invention; and 

FIG. 6 is a flow diagram showing an interrupt routine 



- 3 - 



executed by the engine control microcomputer according to a third 
embodiment of the present invention. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
5 (First embodiment) 

An electronic control system has an electronic control unit 
(ECU), which has a plurality of microcomputers. The 
microcomputers execute engine control such as fuel injection 
control, fuel ignition control, electronic throttle control or 
it the like, respectively, 
rf As shown in FIG. 1, the ECU 10 is equipped with an engine 

J7 control microcomputer 11 for executing engine control, and an 
S electronic throttle control microcomputer 12 for executing 
L, electronic throttle control. These microcomputers 11, 12 are 
ljL connected with each other , and are capable of serial communication 
S therebetween. 

The engine control microcomputer 11 receives an accelerator 
position signal, throttle position signal and other engine 
condition signals such as a rotation speed signal. It calculates 
20 required ignition timing and fuel injection amount based on the 
received signals, and produces control signals to an igniter and 
an injector. 

The throttle microcomputer 12 receives the accelerator 
position signal and the throttle position signal. It calculates 
25 required throttle position for throttle control based on the 
received signals, and produces a control signal to a motor drive 
circuit 13, which comprises H-bridge circuit. The motor drive 
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circuit 13 is connected to a throttle motor 2 2 of a throttle 
actuator 21. The throttle motor 22 drives a throttle valve (not 
shown) and adjusts an amount of intake air supplied to the engine. 

The engine control microcomputer 11 is programmed to 

5 produce a WDC pulse to a WDT (watch-dog timer) 14 , so that the 
WDT 14 may monitor the operation of the engine control 
microcomputer 11 based on the received watch-dog pulse. In this 
case, when the WDT 14 detects malfunction of the engine control 
microcomputer 11, for example a periodicity of the WDC pulse is 
100 out of order, the WDT 14 products a reset signal to the engine 

CO control microcomputer 11. Therefore, the engine control 

f*; microcomputer 11 is reset. 

^ The engine control microcomputer 11 has a monitor program 

IT* to be executed for monitoring operations of the throttle control 

IS? microcomputer 12. The engine control microcomputer 11 is 
programmed to execute the monitor program as a periodic interrupt 
routine, so that the monitor program is executed in a 
predetermined frequency. The engine control microcomputer 11, 
in executing the monitor program, for example, compares results 

20 of calculation made on the same data by the engine control 
microcomputer 11 and the throttle control microcomputer 12, and 
detects malfunction of the throttle control microcomputer 12 when 
the compared calculation results differ from each other. 

The engine control microcomputer 11 has a timer 15. The 

25 timer 15 is set a predetermined time each time when the monitor 
program is accomplished normally. The timer 15 has output 
compare function. The timer 15 switches automatically its output 




- 5 - 



# 



logic level from high to low of its port (throttle relay port 
A), when the time count is decreased to zero. 

Th e ^ timej c^J^--crrntrolg "ar-trr anciotor 16 based on -% h e u ulpuU 
logic level of the throttle relay port A. Namely, when ttjj^dutput 
logic level of the throttle relay port A is high^€he transistor 
16 is turned on to open a motor relay 23 .^^Theref ore, the motor 
drive circuit 13 is supplied withjelectric power from a battery 
to drive the throttle motor 2^\Ojx the other hand, when the output 
logic level of the tl>rt5ttle relay port A is low, the transistor 
16 is turned o£-fr:o close the motor relay 23. Therefore, motor 
drive circuit 13 is not supplied with electric power from the 



^b^ ttory to — sTop — bit e throttle motor 2 2-+ 

The engine control microcomputer 11 is programmed to 
execute a base routine shown in FIG. 2 and an interrupt routine 
shown in FIG. 3. 

As shown in FIG. 2, after power-on of the ECU 10, the engine 
control microcomputer 11 executes an initialization processing 
at step 101. In this initialization processing, the output logic 
level of the throttle relay port A is initialized. Namely, when 
the time count of the timer 15 is not zero, the output logic level 
of the throttle relay port A is set high. When the time count 
of the timer 15 is zero, the output logic level of the throttle 
relay port A is set low. Next, the engine control microcomputer 
11 executes an engine control processing at step 102 to calculate 
the required ignition timing and fuel injection amount in the 
known manner. 



The interrupt routine, shown in FIG. 3, is executed every 
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16 ms. As shown in FIG. 3, the engine control microcomputer 11 
executes monitor processing at step 201 in the known manner. For 
instance, the engine control microcomputer 11 checks (1) whether 
the monitor program is started and ended accurately (entry /end 
check), (2) whether the monitor program is executed in the 
predetermined order, (3) whether the throttle position signal 
calculated by the throttle control microcomputer 12 is equal to 
the throttle position signal calculated by the engine control 
microcomputer 11 or the like, as the monitor processing. Thus, 
if one of the monitor processing is detected as abnormal 
(malfunction), the engine control microcomputer 11 sets an error 
flag indicative of the malfunction. Here, it is possible to 
dispense with above mentioned ( 1 ) or ( 2 ) . 

Next, at step 202, the engine control microcomputer 11 
checks whether the monitor processing at step 201 is normal. The 
processing advances to step 2 03 in response to an affirmative 
determination (YES). Then, the engine control microcomputer 11 
checks whether the time count of the timer 15 is in a predetermined 
acceptable region (e.g., 60 to 68 ms ) . Thus, the processing 
advances to step 204 in response to an affirmative determination 
(YES), and the engine control microcomputer 11 sets a 
predetermined time (e.g., 80 ms ) as the initial time count of 
the timer 15. 

The processing advances to end this routine in response 
to a negative determination (NO) at step 202 or 203. Namely, when 
the monitor processing detects the malfunction at step 201, or 
when the executing timing of the monitor program is not equal 



• 



to predetermined timing (e.g., 16 ms), timer 15 is not set with 
the predetermined time (e.g., 80 ms) . 

As shown in FIG. 4, before timing tl, the throttle control 
microcomputer 12 is not detected as malfunctioning and the monitor 

5 program is executed normally. Therefore, the timer 15 is set with 
the predetermined time (80 ms ) at every 16 ms indicative of the 
executing interval of the monitor program. Namely, before 16 ms 
passes, the timer 15 is set with the predetermined time over and 
over again. In this case, the output logic level of the throttle 
IOC relay port A is maintained high. Thus, the motor relay 23 is 

OS closed, and the electric power supplied to the throttle motor 

^ 22 is maintained. 

- y On the other hand, for example, when the malfunction of 

the throttle control microcomputer 12 is detected or the monitor 

lC program is not executed normally at timing tl, the timer 15 will 
rf never be set with the predetermined time (80 ms) . Then, at timing 
t2 , when the time count of the timer 15 is zero, the output logic 
level of the throttle relay port A is switched low. Thus, the 
motor relay 23 is opened, and the electric power supplied to the 

20 throttle motor 22 is stopped. As a result, controlling the amount 
of intake air supplied to the engine by the throttle actuator 
21 is stopped. 

According to this embodiment, the timer function that is 
equipped in normal microcomputer is used for monitoring operation. 
25 Therefore, a hardware IC for the monitoring operation is not 
required. Therefore, ECU 10 can be simplified. 

Furthermore, when the malfunction of the throttle control 
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microcomputer 12 is detected or the malfunction of the monitor 
program is not executed as designed, the output logic level of 
the throttle relay port A is switched from high to low, and 
electronic throttle control is stopped. Thus, the ECU 10 
5 monitors properly whether electronic throttle control is 
executed normally* 

Moreover, the ECU 10 monitors the interval of executing 
time of the monitor program based on the time count of the timer 
15. When the interval is within the acceptable region, the timer 
l(fe 15 is set with the predetermined time (80 ms ) . Therefore, when 
the monitor program is executed in too short time or too long 
ZI time, the ECU 10 detects the malfunction of the throttle control 
y-j microcomputer 12 or the monitor program. 

In this embodiment, it is possible to set the predetermined 
l|y ; time for monitoring the WDC pulse equal to the predetermined time 
p for monitoring the monitor program. The predetermined time to 
set in the timer 15 may be suitably changed. 
( Second embodiment ) 

In the second embodiment, shown in FIG. 5 one microcomputer 
20 (main microcomputer) 31 of an ECU 30 has both engine control 
function and throttle control function, and another 
microcomputer (auxiliary microcomputer) 32 has only monitoring 
function. For instance, a 32-bit microcomputer is used as the 
main microcomputer, and a 16- or 8-bit microcomputer is used as 
25 the auxiliary microcomputer 32. 

As shown in FIG. 5, ECU 3 0 is equipped with the main 
microcomputer 31 and the auxiliary microcomputer 32. The main 
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microcomputer 31 executes engine control and electronic throttle 
control. Namely , the main microcomputer 31 calculates the 
required ignition timing and fuel injection amount for engine 
control, and throttle position for throttle control. The main 
microcomputer 31 outputs a WDC pulse to WDT 33. Thus, the WDT 
3 3 monitors malfunction of the main microcomputer 31 as in the 
first embodiment. Incidentally, a signal based on the calculated 
results by the main microcomputer 31 is transmitted to the motor 
drive circuit 35 through the auxiliary microcomputer 32. 

The auxiliary microcomputer 32 monitors the throttle 
control executed by the main microcomputer 31. The auxiliary 
microcomputer 3 2 has a monitor program for executing at every 
predetermined interval. According to the monitor program, the 
auxiliary microcomputer 32 detects whether the calculation of 
the main microcomputer 31 is accurate, whether the monitor program 
is started and ended accurately or whether the monitor program 
is executed in the predetermined order. 

The auxiliary microcomputer 32 has a timer 34. The timer 

34 is set with a predetermined time every time when the monitor 
program is accomplished normally. The timer 3 4 has output 
compare function. The timer 34 is switched automatically from 
high to low, when the time count is decreased to zero. Thus, 
throttle motor driving is controlled by a motor drive circuit 

35 based on the output logic level of the port. 

In this case, when the time counted by the timer 34 is not 
zero, the throttle motor is operable. On the other hand, when 
the time counted by the timer 34 is zero, the throttle motor is 



not: operable. 

( Third embodiment ) 

As shown in FIG. 6, in the third embodiment, the monitor 
processing advances to step 205 in response to a negative 

5 determination (NO) at step 202 or 203. Thus, the engine control 
microcomputer 11 sets zero as the time count of the timer 15 , 
and the output logic level of the throttle relay port A is switched 
to low, immediately. Therefore, when the malfunction of the 
throttle control microcomputer 12 is detected or the monitor 
lCfS; program is not executed normally, the throttle motor 22 is stopped, 

S immediately. Thus, ECU 10 executes throttle control more safely. 

Tl ( Modifying embodiment ) 

yL time count can be utilize in place of the timer 15, 34^ror 
15U: decreasing time count. When the time counted by the^fcimer reach 
D a predetermined time, an output logic level of a^Jort is switched. 
In this case, when the throttle control fjrfiction is not detected 
as malfunctioning and the monitor program is executed normally, 
the timer is reset to zero eaph^time. To the contrary, when the 
20 throttle control function is detected as malfunctioning and the 
monitor program i^not executed normally, the timer is not reset 
to zero. Tbtfs, when the timer is not reset, the time counted by 
thetifner reaches the predetermined time (e.g. , 80 ms) , the output 



level of the port is switched. 
25 The microcomputer that monitors the other can be adapted 

to a microcomputer utilized for ABS or bag air. 
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